{"cve":"CVE-2026-42545","nvd":{"published":"2026-05-12T22:16:34.600","modified":"2026-10-26T14:10:00.130","status":"Deferred","description":"Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap() on both the header name and header value constructors, so malformed output from the application becomes a process abort instead of a handled error. This vulnerability is fixed in 2.7.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},"cwes":["CWE-248","CWE-755"],"references":["https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj","https://github.com/emmett-framework/granian/security/advisories/GHSA-f5p7-9fr5-8jmj"],"products":[],"source":"nvd","synced_at":"2026-10-26T14:27:29.784594657+00:00"},"epss":{"cve":"CVE-2026-42545","score":0.00222,"percentile":0.12692,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-f5p7-9fr5-8jmj","url":"https://osv.dev/vulnerability/GHSA-f5p7-9fr5-8jmj","summary":"Granian vulnerable to DoS via WSGI response header panic","modified":"2026-09-10T03:51:05.392679421Z","packages":[{"ecosystem":"PyPI","name":"granian","purl":"pkg:pypi/granian","ranges":[">=0.2.0 <2.7.4"],"fixed":["2.7.4"]}]},{"id":"PYSEC-2026-2502","url":"https://osv.dev/vulnerability/PYSEC-2026-2502","summary":"Granian vulnerable to DoS via WSGI response header panic","modified":"2026-07-13T16:31:55.208372720Z","packages":[{"ecosystem":"PyPI","name":"granian","purl":"pkg:pypi/granian","ranges":[">=0.2.0 <2.7.4"],"fixed":["2.7.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}